Tools
GitHub Made MCP Server Allowlists Generally Available for Enterprises — and They Fail Closed
On Aug 6 GitHub shipped enterprise-managed MCP allowlists to GA across the Copilot app, Copilot CLI, and VS Code, configured with `allowedMcpServers` and `deniedMcpServers` keys in `copilot/managed-settings.json` inside the org's `.github-private` repo. Servers can be matched by `serverUrl` (wildcards supported for remote HTTP/SSE), `serverCommand` for local stdio servers, or user-assigned `serverName`, and settings can be marked `overridable` for team-level customization. Policies fail closed — a malformed or unverifiable configuration is blocked rather than allowed — and when multiple policy layers apply, a server must satisfy all of them.
↳ Follow the thread